Ledger confirms a hardware implant in devices from reseller CryptoBilis: seed read from the screen during setup, funds withdrawn
Since October 9, people who bought Ledger devices through authorized reseller CryptoBilis (Malaysia, Indonesia, the Philippines) have been reporting empty wallets; Ledger confirmed that the affected device contained an unauthorized hardware implant. The implant does not touch the secure chip or change the transactions being signed — it reads what the screen displays, decodes the 24 words during initial setup and sends them out over a mobile network using an eSIM, so the device passed the built-in authenticity check. Ledger says all confirmed losses are linked to this reseller, while its direct sales channel shows no signs of compromise; the total has not been officially confirmed, and blockchain researchers estimate losses of $86–93 million across more than 300 wallets. Separately: on October 13, a major European retail chain suspended Ledger sales after a customer in Germany reported an implant, while an inspection of warehouse and retail stock in Germany found no signs of tampering.
If you bought a Ledger from this reseller and have already set it up, treat the seed as compromised right now: stop using the device, buy a replacement directly from the manufacturer, create a new seed on it and transfer funds to new addresses, checking the recipient address and starting with a small amount. If you have not set up the device yet, do not turn it on and contact the manufacturer's support; never enter or restore an existing seed on such a device. If you bought from another retailer and want to inspect the casing, first make sure you have a backup of your seed: opening the device may damage it; inspection instructions are linked in the post. Calls and messages from “support” are already circulating in connection with this incident: neither the manufacturer nor a custody service ever asks for your 24 words, and figures and claims circulating online are often unverified.
Sources: